ChenKaiLiuG/GoEdgeCommon
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

实现证书管理

Browse Source
This commit is contained in:
刘祥超
2020-09-30 17:46:33 +08:00
parent cdc7dfcc36
commit 5af65705d8
18 changed files with 2269 additions and 853 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/serverconfigs/http_gzip_config.go
View File

@@ -4,11 +4,6 @@ import (
"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/shared"
)
// 默认的文件类型
var (
DefaultGzipMimeTypes = []string{"text/html", "application/json"}
)
// gzip配置
type HTTPGzipConfig struct {
Id int64 `yaml:"id" json:"id"` // ID

18
pkg/serverconfigs/protocol_https_config.go
View File

@@ -2,23 +2,27 @@ package serverconfigs
import "github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
// TLS Version
type TLSVersion = string
// Cipher Suites
type TLSCipherSuite = string
// HTTPS协议配置
type HTTPSProtocolConfig struct {
BaseProtocol `yaml:",inline"`
SSL *sslconfigs.SSLConfig `yaml:"ssl"`
SSLPolicyRef *sslconfigs.SSLRef `yaml:"sslPolicyRef" json:"sslPolicyRef"`
SSLPolicy *sslconfigs.SSLPolicy `yaml:"sslPolicy" json:"sslPolicy"`
}
// 初始化
func (this *HTTPSProtocolConfig) Init() error {
err := this.InitBase()
if err != nil {
return err
}
if this.SSLPolicy != nil {
err := this.SSLPolicy.Init()
if err != nil {
return err
}
}
return nil
}

11
pkg/serverconfigs/protocol_tls_config.go
View File

@@ -2,10 +2,12 @@ package serverconfigs
import "github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
// TLS协议配置
type TLSProtocolConfig struct {
BaseProtocol `yaml:",inline"`
SSL *sslconfigs.SSLConfig `yaml:"ssl" json:"ssl"`
SSLPolicyRef *sslconfigs.SSLRef `yaml:"sslPolicyRef" json:"sslPolicyRef"`
SSLPolicy *sslconfigs.SSLPolicy `yaml:"sslPolicy" json:"sslPolicy"`
}
// 初始化
@@ -15,5 +17,12 @@ func (this *TLSProtocolConfig) Init() error {
return err
}
if this.SSLPolicy != nil {
err := this.SSLPolicy.Init()
if err != nil {
return err
}
}
return nil
}

6
pkg/serverconfigs/server_config.go
View File

@@ -196,12 +196,12 @@ func (this *ServerConfig) MatchNameStrictly(name string) bool {
}
// SSL信息
func (this *ServerConfig) SSLConfig() *sslconfigs.SSLConfig {
func (this *ServerConfig) SSLPolicy() *sslconfigs.SSLPolicy {
if this.HTTPS != nil {
return this.HTTPS.SSL
return this.HTTPS.SSLPolicy
}
if this.TLS != nil {
return this.TLS.SSL
return this.TLS.SSLPolicy
}
return nil
}

207
pkg/serverconfigs/sslconfigs/ssl.go
View File

@@ -1,207 +0,0 @@
package sslconfigs
import (
"crypto/tls"
"crypto/x509"
"errors"
"github.com/iwind/TeaGo/types"
"io/ioutil"
"net"
"regexp"
"strconv"
"strings"
)
// TLS Version
type TLSVersion = string
// Cipher Suites
type TLSCipherSuite = string
// SSL配置
type SSLConfig struct {
IsOn bool `yaml:"isOn" json:"isOn"` // 是否开启
Certs []*SSLCertConfig `yaml:"certs" json:"certs"`
ClientAuthType SSLClientAuthType `yaml:"clientAuthType" json:"clientAuthType"` // 客户端认证类型
ClientCACertIds []string `yaml:"clientCACertIds" json:"clientCACertIds"` // 客户端认证CA
Listen []string `yaml:"listen" json:"listen"` // 网络地址
MinVersion TLSVersion `yaml:"minVersion" json:"minVersion"` // 支持的最小版本
CipherSuites []TLSCipherSuite `yaml:"cipherSuites" json:"cipherSuites"` // 加密算法套件
HSTS *HSTSConfig `yaml:"hsts2" json:"hsts"` // HSTS配置，yaml之所以使用hsts2，是因为要和以前的版本分开
HTTP2Disabled bool `yaml:"http2Disabled" json:"http2Disabled"` // 是否禁用HTTP2
nameMapping map[string]*tls.Certificate // dnsName => cert
minVersion uint16
cipherSuites []uint16
clientCAPool *x509.CertPool
}
// 获取新对象
func NewSSLConfig() *SSLConfig {
return &SSLConfig{}
}
// 校验配置
func (this *SSLConfig) Init() error {
if !this.IsOn {
return nil
}
if len(this.Certs) == 0 {
return errors.New("no certificates in https config")
}
for _, cert := range this.Certs {
err := cert.Init()
if err != nil {
return err
}
}
if this.Listen == nil {
this.Listen = []string{}
} else {
for index, addr := range this.Listen {
_, _, err := net.SplitHostPort(addr)
if err != nil {
this.Listen[index] = strings.TrimSuffix(addr, ":") + ":443"
}
}
}
// min version
this.convertMinVersion()
// cipher suite categories
this.initCipherSuites()
// hsts
if this.HSTS != nil {
err := this.HSTS.Init()
if err != nil {
return err
}
}
// CA证书
if len(this.ClientCACertIds) > 0 && this.ClientAuthType != SSLClientAuthTypeNoClientCert {
this.clientCAPool = x509.NewCertPool()
list := SharedSSLCertList()
for _, certId := range this.ClientCACertIds {
cert := list.FindCert(certId)
if cert == nil {
continue
}
if !cert.IsOn {
continue
}
data, err := ioutil.ReadFile(cert.FullCertPath())
if err != nil {
return err
}
this.clientCAPool.AppendCertsFromPEM(data)
}
}
return nil
}
// 取得最小版本
func (this *SSLConfig) TLSMinVersion() uint16 {
return this.minVersion
}
// 套件
func (this *SSLConfig) TLSCipherSuites() []uint16 {
return this.cipherSuites
}
// 校验是否匹配某个域名
func (this *SSLConfig) MatchDomain(domain string) (cert *tls.Certificate, ok bool) {
for _, cert := range this.Certs {
if cert.MatchDomain(domain) {
return cert.CertObject(), true
}
}
return nil, false
}
// 取得第一个证书
func (this *SSLConfig) FirstCert() *tls.Certificate {
for _, cert := range this.Certs {
return cert.CertObject()
}
return nil
}
// 是否包含某个证书或密钥路径
func (this *SSLConfig) ContainsFile(file string) bool {
for _, cert := range this.Certs {
if cert.CertFile == file || cert.KeyFile == file {
return true
}
}
return false
}
// 删除证书文件
func (this *SSLConfig) DeleteFiles() error {
var resultErr error = nil
for _, cert := range this.Certs {
err := cert.DeleteFiles()
if err != nil {
resultErr = err
}
}
return resultErr
}
// 查找单个证书配置
func (this *SSLConfig) FindCert(certId string) *SSLCertConfig {
for _, cert := range this.Certs {
if cert.Id == certId {
return cert
}
}
return nil
}
// 添加证书
func (this *SSLConfig) AddCert(cert *SSLCertConfig) {
this.Certs = append(this.Certs, cert)
}
// CA证书Pool，用于TLS对客户端进行认证
func (this *SSLConfig) CAPool() *x509.CertPool {
return this.clientCAPool
}
// 分解所有监听地址
func (this *SSLConfig) ParseListenAddresses() []string {
result := []string{}
var reg = regexp.MustCompile(`\[\s*(\d+)\s*[,:-]\s*(\d+)\s*]$`)
for _, addr := range this.Listen {
match := reg.FindStringSubmatch(addr)
if len(match) == 0 {
result = append(result, addr)
} else {
min := types.Int(match[1])
max := types.Int(match[2])
if min > max {
min, max = max, min
}
for i := min; i <= max; i++ {
newAddr := reg.ReplaceAllString(addr, ":"+strconv.Itoa(i))
result = append(result, newAddr)
}
}
}
return result
}

271
pkg/serverconfigs/sslconfigs/ssl_cert.go
View File

@@ -1,271 +0,0 @@
package sslconfigs
import (
"crypto/tls"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"errors"
"github.com/TeaOSLab/EdgeCommon/pkg/configutils"
"github.com/iwind/TeaGo/Tea"
"github.com/iwind/TeaGo/files"
"github.com/iwind/TeaGo/lists"
"github.com/iwind/TeaGo/utils/string"
"io/ioutil"
"strings"
"time"
)
// SSL证书
type SSLCertConfig struct {
Id string `yaml:"id" json:"id"`
IsOn bool `yaml:"isOn" json:"isOn"`
Description string `yaml:"description" json:"description"` // 说明
CertFile string `yaml:"certFile" json:"certFile"`
KeyFile string `yaml:"keyFile" json:"keyFile"`
IsLocal bool `yaml:"isLocal" json:"isLocal"` // 是否为本地文件
TaskId string `yaml:"taskId" json:"taskId"` // 生成证书任务ID
IsShared bool `yaml:"isShared" json:"isShared"` // 是否为公用组件
ServerName string `yaml:"serverName" json:"serverName"` // 证书使用的主机名，在请求TLS服务器时需要
IsCA bool `yaml:"isCA" json:"isCA"` // 是否为CA证书
dnsNames []string
cert *tls.Certificate
timeBefore time.Time
timeAfter time.Time
issuer pkix.Name
}
// 获取新的SSL证书
func NewSSLCertConfig(certFile string, keyFile string) *SSLCertConfig {
return &SSLCertConfig{
IsOn: true,
Id: stringutil.Rand(16),
CertFile: certFile,
KeyFile: keyFile,
}
}
// 校验
func (this *SSLCertConfig) Init() error {
if this.IsShared {
shared := this.FindShared()
if shared == nil {
return errors.New("the shared cert has been deleted")
}
// 拷贝之前需要保留的
serverName := this.ServerName
// copy
configutils.CopyStructObject(this, shared)
this.ServerName = serverName
}
this.dnsNames = []string{}
if len(this.CertFile) == 0 {
return errors.New("cert file should not be empty")
}
// 分析证书
if this.IsCA { // CA证书
data, err := ioutil.ReadFile(this.FullCertPath())
if err != nil {
return err
}
index := -1
this.cert = &tls.Certificate{
Certificate: [][]byte{},
}
for {
index++
block, rest := pem.Decode(data)
if block == nil {
break
}
if len(rest) == 0 {
break
}
this.cert.Certificate = append(this.cert.Certificate, block.Bytes)
data = rest
c, err := x509.ParseCertificate(block.Bytes)
if err != nil {
return err
}
if c == nil {
return errors.New("no available certificates in file")
}
dnsNames := c.DNSNames
if len(dnsNames) > 0 {
for _, dnsName := range dnsNames {
if !lists.ContainsString(this.dnsNames, dnsName) {
this.dnsNames = append(this.dnsNames, dnsName)
}
}
}
if index == 0 {
this.timeBefore = c.NotBefore
this.timeAfter = c.NotAfter
this.issuer = c.Issuer
}
}
} else { // 证书+私钥
if len(this.KeyFile) == 0 {
return errors.New("key file should not be empty")
}
cert, err := tls.LoadX509KeyPair(this.FullCertPath(), this.FullKeyPath())
if err != nil {
return errors.New("load certificate '" + this.CertFile + "', '" + this.KeyFile + "' failed:" + err.Error())
}
for index, data := range cert.Certificate {
c, err := x509.ParseCertificate(data)
if err != nil {
continue
}
dnsNames := c.DNSNames
if len(dnsNames) > 0 {
for _, dnsName := range dnsNames {
if !lists.ContainsString(this.dnsNames, dnsName) {
this.dnsNames = append(this.dnsNames, dnsName)
}
}
}
if index == 0 {
this.timeBefore = c.NotBefore
this.timeAfter = c.NotAfter
this.issuer = c.Issuer
}
}
this.cert = &cert
}
return nil
}
// 查找共享的证书
func (this *SSLCertConfig) FindShared() *SSLCertConfig {
if !this.IsShared {
return nil
}
return SharedSSLCertList().FindCert(this.Id)
}
// 证书文件路径
func (this *SSLCertConfig) FullCertPath() string {
if len(this.CertFile) == 0 {
return ""
}
if !strings.ContainsAny(this.CertFile, "/\\") {
return Tea.ConfigFile(this.CertFile)
}
return this.CertFile
}
// 密钥文件路径
func (this *SSLCertConfig) FullKeyPath() string {
if len(this.KeyFile) == 0 {
return ""
}
if !strings.ContainsAny(this.KeyFile, "/\\") {
return Tea.ConfigFile(this.KeyFile)
}
return this.KeyFile
}
// 校验是否匹配某个域名
func (this *SSLCertConfig) MatchDomain(domain string) bool {
if len(this.dnsNames) == 0 {
return false
}
return configutils.MatchDomains(this.dnsNames, domain)
}
// 证书中的域名
func (this *SSLCertConfig) DNSNames() []string {
return this.dnsNames
}
// 获取证书对象
func (this *SSLCertConfig) CertObject() *tls.Certificate {
return this.cert
}
// 开始时间
func (this *SSLCertConfig) TimeBefore() time.Time {
return this.timeBefore
}
// 结束时间
func (this *SSLCertConfig) TimeAfter() time.Time {
return this.timeAfter
}
// 发行信息
func (this *SSLCertConfig) Issuer() pkix.Name {
return this.issuer
}
// 删除文件
func (this *SSLCertConfig) DeleteFiles() error {
if this.IsLocal {
return nil
}
var resultErr error = nil
if len(this.CertFile) > 0 && !strings.ContainsAny(this.CertFile, "/\\") {
err := files.NewFile(this.FullCertPath()).Delete()
if err != nil {
resultErr = err
}
}
if len(this.KeyFile) > 0 && !strings.ContainsAny(this.KeyFile, "/\\") {
err := files.NewFile(this.FullKeyPath()).Delete()
if err != nil {
resultErr = err
}
}
return resultErr
}
// 读取证书文件
func (this *SSLCertConfig) ReadCert() ([]byte, error) {
if len(this.CertFile) == 0 {
return nil, errors.New("cert file should not be empty")
}
if this.IsLocal {
return ioutil.ReadFile(this.CertFile)
}
return ioutil.ReadFile(Tea.ConfigFile(this.CertFile))
}
// 读取密钥文件
func (this *SSLCertConfig) ReadKey() ([]byte, error) {
if len(this.KeyFile) == 0 {
return nil, errors.New("key file should not be empty")
}
if this.IsLocal {
return ioutil.ReadFile(this.KeyFile)
}
return ioutil.ReadFile(Tea.ConfigFile(this.KeyFile))
}
// 匹配关键词
func (this *SSLCertConfig) MatchKeyword(keyword string) (matched bool, name string, tags []string) {
if configutils.MatchKeyword(this.Description, keyword) {
matched = true
name = this.Description
}
return
}

140
pkg/serverconfigs/sslconfigs/ssl_cert_config.go Normal file
View File

@@ -0,0 +1,140 @@
package sslconfigs
import (
"crypto/tls"
"crypto/x509"
"encoding/pem"
"errors"
"github.com/TeaOSLab/EdgeCommon/pkg/configutils"
"github.com/iwind/TeaGo/lists"
"strconv"
"time"
)
// SSL证书
type SSLCertConfig struct {
Id int64 `yaml:"id" json:"id"`
IsOn bool `yaml:"isOn" json:"isOn"`
Name string `yaml:"name" json:"name"`
Description string `yaml:"description" json:"description"` // 说明
CertData []byte `yaml:"certData" json:"certData"` // 证书数据
KeyData []byte `yaml:"keyData" json:"keyData"` // 密钥数据
ServerName string `yaml:"serverName" json:"serverName"` // 证书使用的主机名，在请求TLS服务器时需要
IsCA bool `yaml:"isCA" json:"isCA"` // 是否为CA证书
// 以下是从证书中分析所得
TimeBeginAt int64 `yaml:"timeBeginAt" json:"timeBeginAt"`
TimeEndAt int64 `yaml:"timeEndAt" json:"timeEndAt"`
DNSNames []string `yaml:"dnsNames" json:"dnsNames"`
CommonNames []string `yaml:"commonNames" json:"commonNames"`
cert *tls.Certificate
timeBegin time.Time
timeEnd time.Time
}
// 校验
func (this *SSLCertConfig) Init() error {
var commonNames []string // 发行组织
var dnsNames []string // 域名
// 分析证书
if this.IsCA { // CA证书
data := this.CertData
index := -1
this.cert = &tls.Certificate{
Certificate: [][]byte{},
}
for {
index++
block, rest := pem.Decode(data)
if block == nil {
break
}
if len(rest) == 0 {
break
}
this.cert.Certificate = append(this.cert.Certificate, block.Bytes)
data = rest
c, err := x509.ParseCertificate(block.Bytes)
if err != nil {
return err
}
if c == nil {
return errors.New("no available certificates in file")
}
for _, dnsName := range c.DNSNames {
if !lists.ContainsString(dnsNames, dnsName) {
dnsNames = append(dnsNames, dnsName)
}
}
commonNames = append(commonNames, c.Issuer.CommonName)
if index == 0 {
this.timeBegin = c.NotBefore
this.timeEnd = c.NotAfter
}
}
} else { // 证书+私钥
cert, err := tls.X509KeyPair(this.CertData, this.KeyData)
if err != nil {
return errors.New("load certificate '" + strconv.FormatInt(this.Id, 10) + "' failed:" + err.Error())
}
for index, data := range cert.Certificate {
c, err := x509.ParseCertificate(data)
if err != nil {
continue
}
for _, dnsName := range c.DNSNames {
if !lists.ContainsString(dnsNames, dnsName) {
dnsNames = append(dnsNames, dnsName)
}
}
commonNames = append(commonNames, c.Issuer.CommonName)
if index == 0 {
this.timeBegin = c.NotBefore
this.timeEnd = c.NotAfter
}
}
this.cert = &cert
}
// 赋值分析结果
this.DNSNames = dnsNames
this.CommonNames = commonNames
this.TimeBeginAt = this.timeBegin.Unix()
this.TimeEndAt = this.timeEnd.Unix()
return nil
}
// 校验是否匹配某个域名
func (this *SSLCertConfig) MatchDomain(domain string) bool {
if len(this.DNSNames) == 0 {
return false
}
return configutils.MatchDomains(this.DNSNames, domain)
}
// 获取证书对象
func (this *SSLCertConfig) CertObject() *tls.Certificate {
return this.cert
}
// 开始时间
func (this *SSLCertConfig) TimeBegin() time.Time {
return this.timeBegin
}
// 结束时间
func (this *SSLCertConfig) TimeEnd() time.Time {
return this.timeEnd
}

86
pkg/serverconfigs/sslconfigs/ssl_cert_list.go
View File

@@ -1,86 +0,0 @@
package sslconfigs
import (
"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/shared"
"github.com/iwind/TeaGo/Tea"
"github.com/iwind/TeaGo/logs"
"gopkg.in/yaml.v3"
"io/ioutil"
)
const (
sslCertListFilename = "ssl.certs.conf"
)
// 获取证书列表实例
// 一定会返回不为nil的值
func SharedSSLCertList() *SSLCertList {
data, err := ioutil.ReadFile(Tea.ConfigFile(sslCertListFilename))
if err != nil {
return NewSSLCertList()
}
list := &SSLCertList{}
err = yaml.Unmarshal(data, list)
if err != nil {
logs.Error(err)
return NewSSLCertList()
}
return list
}
// 公共的SSL证书列表
type SSLCertList struct {
Certs []*SSLCertConfig `yaml:"certs" json:"certs"` // 证书
}
// 获取新对象
func NewSSLCertList() *SSLCertList {
return &SSLCertList{
Certs: []*SSLCertConfig{},
}
}
// 添加证书
func (this *SSLCertList) AddCert(cert *SSLCertConfig) {
this.Certs = append(this.Certs, cert)
}
// 删除证书
func (this *SSLCertList) RemoveCert(certId string) {
result := []*SSLCertConfig{}
for _, cert := range this.Certs {
if cert.Id == certId {
continue
}
result = append(result, cert)
}
this.Certs = result
}
// 查找证书
func (this *SSLCertList) FindCert(certId string) *SSLCertConfig {
if len(certId) == 0 {
return nil
}
for _, cert := range this.Certs {
if cert.Id == certId {
return cert
}
}
return nil
}
// 保存
func (this *SSLCertList) Save() error {
shared.Locker.Lock()
defer shared.Locker.Unlock()
data, err := yaml.Marshal(this)
if err != nil {
return err
}
return ioutil.WriteFile(Tea.ConfigFile(sslCertListFilename), data, 0777)
}

6
pkg/serverconfigs/sslconfigs/ssl_cert_ref.go Normal file
View File

@@ -0,0 +1,6 @@
package sslconfigs
type SSLCertRef struct {
IsOn bool `yaml:"isOn" json:"isOn"`
CertId int64 `yaml:"certId" json:"certId"`
}

6
pkg/serverconfigs/sslconfigs/ssl_go_1.12.go → pkg/serverconfigs/sslconfigs/ssl_consts.go
View File

@@ -1,5 +1,3 @@
// +build go1.12
package sslconfigs
import (
@@ -68,7 +66,7 @@ var TLSIntermediateCipherSuites = []string{
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
}
func (this *SSLConfig) convertMinVersion() {
func (this *SSLPolicy) convertMinVersion() {
switch this.MinVersion {
case "SSL 3.0":
this.minVersion = tls.VersionSSL30
@@ -87,7 +85,7 @@ func (this *SSLConfig) convertMinVersion() {
}
}
func (this *SSLConfig) initCipherSuites() {
func (this *SSLPolicy) initCipherSuites() {
// cipher suites
suites := []uint16{}
for _, suite := range this.CipherSuites {

124
pkg/serverconfigs/sslconfigs/ssl_go_1.11.go
View File

@@ -1,124 +0,0 @@
// +build !go1.12
package sslconfigs
import "crypto/tls"
var AllTlsVersions = []TLSVersion{"SSL 3.0", "TLS 1.0", "TLS 1.1", "TLS 1.2"}
var AllTLSCipherSuites = []TLSCipherSuite{
"TLS_RSA_WITH_RC4_128_SHA",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA256",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
}
var TLSModernCipherSuites = []string{
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
}
var TLSIntermediateCipherSuites = []string{
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
}
func (this *SSLConfig) convertMinVersion() {
switch this.MinVersion {
case "SSL 3.0":
this.minVersion = tls.VersionSSL30
case "TLS 1.0":
this.minVersion = tls.VersionTLS10
case "TLS 1.1":
this.minVersion = tls.VersionTLS11
case "TLS 1.2":
this.minVersion = tls.VersionTLS12
default:
this.minVersion = tls.VersionTLS10
}
}
func (this *SSLConfig) initCipherSuites() {
// cipher suites
suites := []uint16{}
for _, suite := range this.CipherSuites {
switch suite {
case "TLS_RSA_WITH_RC4_128_SHA":
suites = append(suites, tls.TLS_RSA_WITH_RC4_128_SHA)
case "TLS_RSA_WITH_3DES_EDE_CBC_SHA":
suites = append(suites, tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA)
case "TLS_RSA_WITH_AES_128_CBC_SHA":
suites = append(suites, tls.TLS_RSA_WITH_AES_128_CBC_SHA)
case "TLS_RSA_WITH_AES_256_CBC_SHA":
suites = append(suites, tls.TLS_RSA_WITH_AES_256_CBC_SHA)
case "TLS_RSA_WITH_AES_128_CBC_SHA256":
suites = append(suites, tls.TLS_RSA_WITH_AES_128_CBC_SHA256)
case "TLS_RSA_WITH_AES_128_GCM_SHA256":
suites = append(suites, tls.TLS_RSA_WITH_AES_128_GCM_SHA256)
case "TLS_RSA_WITH_AES_256_GCM_SHA384":
suites = append(suites, tls.TLS_RSA_WITH_AES_256_GCM_SHA384)
case "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA":
suites = append(suites, tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA)
case "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA":
suites = append(suites, tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA)
case "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA":
suites = append(suites, tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA)
case "TLS_ECDHE_RSA_WITH_RC4_128_SHA":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA)
case "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA)
case "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA)
case "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA)
case "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256":
suites = append(suites, tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256)
case "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)
case "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
case "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256":
suites = append(suites, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
case "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
case "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384":
suites = append(suites, tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
case "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305":
suites = append(suites, tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305)
case "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305":
suites = append(suites, tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305)
}
}
this.cipherSuites = suites
}

35
pkg/serverconfigs/sslconfigs/ssl_hsts_test.go
View File

@@ -7,33 +7,54 @@ import (
func TestHSTSConfig(t *testing.T) {
h := &HSTSConfig{}
h.Init()
err := h.Init()
if err != nil {
t.Fatal(err)
}
t.Log(h.HeaderValue())
h.IncludeSubDomains = true
h.Init()
err = h.Init()
if err != nil {
t.Fatal(err)
}
t.Log(h.HeaderValue())
h.Preload = true
h.Init()
err = h.Init()
if err != nil {
t.Fatal(err)
}
t.Log(h.HeaderValue())
h.IncludeSubDomains = false
h.Init()
err = h.Init()
if err != nil {
t.Fatal(err)
}
t.Log(h.HeaderValue())
h.MaxAge = 86400
h.Init()
err = h.Init()
if err != nil {
t.Fatal(err)
}
t.Log(h.HeaderValue())
a := assert.NewAssertion(t)
a.IsTrue(h.Match("abc.com"))
h.Domains = []string{"abc.com"}
h.Init()
err = h.Init()
if err != nil {
t.Fatal(err)
}
a.IsTrue(h.Match("abc.com"))
h.Domains = []string{"1.abc.com"}
h.Init()
err = h.Init()
if err != nil {
t.Fatal(err)
}
a.IsFalse(h.Match("abc.com"))
}

99
pkg/serverconfigs/sslconfigs/ssl_policy.go Normal file
View File

@@ -0,0 +1,99 @@
package sslconfigs
import (
"crypto/tls"
"crypto/x509"
"errors"
)
// TLS Version
type TLSVersion = string
// Cipher Suites
type TLSCipherSuite = string
// SSL配置
type SSLPolicy struct {
Id int64 `yaml:"id" json:"id"` // ID
IsOn bool `yaml:"isOn" json:"isOn"` // 是否开启
CertRefs []*SSLCertRef `yaml:"certRefs" json:"certRefs"`
Certs []*SSLCertConfig `yaml:"certs" json:"certs"`
ClientAuthType SSLClientAuthType `yaml:"clientAuthType" json:"clientAuthType"` // 客户端认证类型
MinVersion TLSVersion `yaml:"minVersion" json:"minVersion"` // 支持的最小版本
CipherSuites []TLSCipherSuite `yaml:"cipherSuites" json:"cipherSuites"` // 加密算法套件
HSTS *HSTSConfig `yaml:"hsts2" json:"hsts"` // HSTS配置，yaml之所以使用hsts2，是因为要和以前的版本分开
HTTP2Enabled bool `yaml:"http2Enabled" json:"http2Enabled"` // 是否启用HTTP2
nameMapping map[string]*tls.Certificate // dnsName => cert
minVersion uint16
cipherSuites []uint16
clientCAPool *x509.CertPool
}
// 校验配置
func (this *SSLPolicy) Init() error {
if len(this.Certs) == 0 {
return errors.New("no certificates in https config")
}
for _, cert := range this.Certs {
err := cert.Init()
if err != nil {
return err
}
}
// min version
this.convertMinVersion()
// cipher suite categories
this.initCipherSuites()
// hsts
if this.HSTS != nil {
err := this.HSTS.Init()
if err != nil {
return err
}
}
return nil
}
// 取得最小版本
func (this *SSLPolicy) TLSMinVersion() uint16 {
return this.minVersion
}
// 套件
func (this *SSLPolicy) TLSCipherSuites() []uint16 {
return this.cipherSuites
}
// 校验是否匹配某个域名
func (this *SSLPolicy) MatchDomain(domain string) (cert *tls.Certificate, ok bool) {
for _, cert := range this.Certs {
if cert.MatchDomain(domain) {
return cert.CertObject(), true
}
}
return nil, false
}
// 取得第一个证书
func (this *SSLPolicy) FirstCert() *tls.Certificate {
for _, cert := range this.Certs {
return cert.CertObject()
}
return nil
}
// CA证书Pool，用于TLS对客户端进行认证
func (this *SSLPolicy) CAPool() *x509.CertPool {
return this.clientCAPool
}

6
pkg/serverconfigs/sslconfigs/ssl_ref.go Normal file
View File

@@ -0,0 +1,6 @@
package sslconfigs
type SSLRef struct {
IsOn bool `yaml:"isOn" json:"isOn"`
SSLPolicyId int64 `yaml:"sslPolicyId" json:"sslPolicyId"`
}